With UBSAN gcc compiler I see: $ UBSAN_OPTIONS="print_stacktrace=1" ./xgcc -B. /home/marxin/Programming/gcc/gcc/testsuite/g++.dg/pr71633.C -c -O3 -mmpx -O2 -std=gnu++11 -fcheck-pointer-bounds ../../gcc/ipa-pure-const.c:1951:22: runtime error: load of value 118, which is not a valid value for type 'bool' #0 0x761403 in propagate_malloc ../../gcc/ipa-pure-const.c:1951 #1 0x761403 in execute ../../gcc/ipa-pure-const.c:2017 #2 0x20c2e9c in execute_one_pass(opt_pass*) ../../gcc/passes.c:2497 #3 0x20c9217 in execute_ipa_pass_list(opt_pass*) ../../gcc/passes.c:2932 #4 0x121c532 in ipa_passes ../../gcc/cgraphunit.c:2476 #5 0x121c532 in symbol_table::compile() ../../gcc/cgraphunit.c:2558 #6 0x1227bd6 in symbol_table::finalize_compilation_unit() ../../gcc/cgraphunit.c:2717 #7 0x25a2ffc in compile_file ../../gcc/toplev.c:480 #8 0x77e2e9 in do_compile ../../gcc/toplev.c:2132 #9 0x77e2e9 in toplev::main(int, char**) ../../gcc/toplev.c:2267 #10 0x78117a in main ../../gcc/main.c:39 #11 0x7f766edbe6e4 in __libc_start_main (/lib64/libc.so.6+0x206e4) #12 0x7812a8 in _start (/home/marxin/Programming/gcc/objdir/gcc/cc1plus+0x7812a8)
Same can be seen with valgrind: $ valgrind --leak-check=yes --trace-children=yes ./xgcc -B. /home/marxin/Programming/gcc/gcc/testsuite/g++.dg/pr71633.C -c -O3 -mmpx -O2 -std=gnu++11 -fcheck-pointer-bounds ==19734== Conditional jump or move depends on uninitialised value(s) ==19734== at 0x1637811: propagate_malloc (ipa-pure-const.c:1951) ==19734== by 0x1637811: (anonymous namespace)::pass_ipa_pure_const::execute(function*) (ipa-pure-const.c:2017) ==19734== by 0xCF27F0: execute_one_pass(opt_pass*) (passes.c:2497) ==19734== by 0xCF37F1: execute_ipa_pass_list(opt_pass*) (passes.c:2932) ==19734== by 0x99816B: ipa_passes (cgraphunit.c:2476) ==19734== by 0x99816B: symbol_table::compile() [clone .part.56] (cgraphunit.c:2558) ==19734== by 0x99A916: compile (cgraphunit.c:2720) ==19734== by 0x99A916: symbol_table::finalize_compilation_unit() (cgraphunit.c:2717) ==19734== by 0xDCF95A: compile_file() (toplev.c:480) ==19734== by 0x608A04: do_compile (toplev.c:2132) ==19734== by 0x608A04: toplev::main(int, char**) (toplev.c:2267) ==19734== by 0x60AFBA: main (main.c:39)
MPX is removed, won't fix then.